nx_hr_access.nx

nx_hr_access.nx -- the SHARED access adapter: resolve a no-cookie SESSION TOKEN to an HR level, so EVERY gated surface (gallery, hub, torrent already does this) uses the ONE access SSOT (nx_hr) instead of its own flat/realm gating. This is the mechanism the HR roadmap called for ("wire gallery/hub level resolution to HR"); it is ADDITIVE -- a surface IMPORTS it and calls hac_gate(...) at its resource boundary, no surface daemon is rewritten here (coordination-correct: provide the mechanism, the owning workstream adopts it). The chain (all sovereign): olg_whoami validates the Ed25519 no-cookie token -> the 32-byte user-id hash == the HR cred_id (SHA-256(realm|||handle); verified) -> hr_resolve_level. DENY-BY-DEFAULT at every step: an invalid/expired token, or a valid token for a user NOT enrolled in HR (authenticated but not authorized), or a suspended user, all resolve to level 0. So AUTHENTICATION alone grants nothing -- HR is the authority. realm-agnostic (the token's uid already encodes its realm), so one adapter serves every property.